---
id: "CVE-2026-120448"
kind: "vulnerability"
aliases: ["CVE-2026-120448"]
title: "DoraCMS: mass assignment lets low-privileged users take over other accounts"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "DoraCMS", "fixed": [], "affected": "<= 3.1.0 (before commit ede38eb0)", "ecosystem": "npm"}]
ecosystems: []
tags: ["doracms", "node.js", "package", "self-hosted"]
not_affected_if: ["no-api-keys", "no-public-registration"]
published_at: "2026-11-02T15:17:27+00:00"
first_seen_at: "2026-11-02T15:24:02+00:00"
updated_at: "2026-11-02T15:27:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120448", "first_seen_at": "2026-11-02T15:24:02+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T15:27:29+00:00"}]
---

# DoraCMS: mass assignment lets low-privileged users take over other accounts

DoraCMS through 3.1.0 lets an authenticated low-privileged user change the userId on their own API key to another user's id. The attacker can then act as that victim to edit profiles and publish or delete content.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:DoraCMS affected <= 3.1.0 (before commit ede38eb0) fixed ?

## How to check

- Check your DoraCMS checkout: affected if it is 3.1.0 or earlier (researcher: 3.0.x to 3.1, commit 70cf0fc) and lacks commit ede38eb0 (git branch --contains ede38eb0).
- In server/app/service/apiKey.js, updateApiKey is vulnerable if it builds updateData with ...data; fixed if it loops over an allowlist of fields.
- Look in access logs for PUT /api/v1/user/api-keys/:id with a userId in the body, and for API keys whose userId differs from their creator.

## Fix

No released version named in sources. Fixed in git commit ede38eb06e0becbee9f19190ebf3ada90a369eb0 (server/app/service/apiKey.js now only accepts name, permissions, ipWhitelist, rateLimit, expiresAt). Update to a build containing that commit.

## Timeline

- 2026-11-02T15:24:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120448
- 2026-11-02T15:27:29+00:00 analyst — Maintainer commit ede38eb0 (2026-11-02) allowlists name/permissions/ipWhitelist/rateLimit/expiresAt in apiKey.js updateApiKey; no tagged release names a fix, so fix is the commit. Researcher report has public PoC (affected 3.0.x to 3.1, commit 70cf0fc); no exploitation reported.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/doracms-through-3.1.0-mass-assignment-via-api-key-update-endpoint
- [fix] DoraCMS commit ede38eb: restrict API key update fields https://github.com/doramart/DoraCMS/commit/ede38eb06e0becbee9f19190ebf3ada90a369eb0
- [poc] DoraCMS Vulnerability Report (Wu Yulun) https://vul.yulun.ac.cn/20261102/doracms/

## From the sources

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_